The HIPAA Security Rule, explained for a small practice

The HIPAA Security Rule requires a covered entity to put reasonable and appropriate administrative, physical and technical safeguards in place for electronic protected health information (45 CFR 164.302 to 164.318). Required specifications must be implemented, and each addressable one must first be assessed (164.306(d)).

What is the HIPAA Security Rule?

The HIPAA Security Rule is the part of 45 CFR 164.302 to 164.318 that sets safeguards for electronic protected health information, or ePHI. HHS summarizes it as requiring covered entities and business associates to implement reasonable and appropriate administrative, physical and technical safeguards for ePHI (HHS summary of the Security Rule).

The rule covers ePHI only. Paper PHI falls under the Privacy Rule's safeguards standard in 45 CFR 164.530(c) instead. The rule applies to a small practice's electronic records, including any online fax it sends, receives or stores. The Privacy Rule sets when PHI may be used or disclosed, and the Security Rule sets how ePHI must be protected.

What are the three types of safeguards in the Security Rule?

The Security Rule has three types of safeguards: administrative, physical and technical. The table names the rule section for each type and what a small practice does under it.

Each type holds standards, and most standards carry required or addressable implementation specifications. The policies that carry the three types out fall under 45 CFR 164.316(a).

What is the difference between required and addressable?

A required implementation specification must be implemented, and an addressable one must first be assessed for whether it is a reasonable and appropriate safeguard in the practice's environment (45 CFR 164.306(d)(1) and (d)(3)(i)). The Security Rule uses one of these two labels for every implementation specification, so a practice reads the label before it acts on the specification.

Encryption of ePHI in transmission is the standard example. The rule says to implement a mechanism to encrypt ePHI "whenever deemed appropriate" (45 CFR 164.312(e)(2)(ii)), so the practice's own assessment decides whether encryption is reasonable for its environment. The risk analysis and risk management specifications, by contrast, are required (164.308(a)(1)(ii)(A) and (B)).

Does the Security Rule apply to fax?

The Security Rule applies to a fax only when the fax is electronic PHI, such as an online fax the practice sends, receives or stores (45 CFR 164.308 and 164.312). A fax that exists only on paper falls under the Privacy Rule's safeguards standard in 45 CFR 164.530(c) instead. A fax the practice stores on its own system is ePHI in the same way, and the access controls in 164.312(a)(1) apply to it.

A fax service that handles ePHI for the practice may do so only with satisfactory assurances under 164.314(a) (164.308(b)(1)). The HIPAA fax requirements checklist lists the fax-specific items. A practice comparing vendors may also ask whether a HIPAA fax service needs SOC 2 or HITRUST.

Is a risk analysis required every year?

The Security Rule requires a risk analysis, but its text sets no fixed yearly interval for repeating one (45 CFR 164.308(a)(1)(ii)(A)). The analysis must be an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.

Risk management follows. It requires security measures that reduce those risks to a reasonable and appropriate level (164.308(a)(1)(ii)(B)). The rule marks both steps as required, so a covered entity of any size carries both duties. The documentation of the analysis falls under the six-year retention period in 164.316(b)(2)(i), because it is an assessment the Security Rule requires (164.316(b)(1)).

Does the 2025 Security Rule update apply now?

The 2025 cybersecurity update to the Security Rule does not apply yet, because HHS still lists it as a Proposed Rule dated January 6, 2025. Its proposed requirements have no binding effect until a final rule takes their place. This article describes the rule as it stands in the current regulation text.

What do the technical safeguards require for a small practice?

The technical standards in 45 CFR 164.312 cover access control, audit controls, integrity, person or entity authentication and transmission security. Access control allows ePHI access only to persons or programs granted access rights under 164.308(a)(4) (164.312(a)(1)). Audit controls require mechanisms that record and examine activity in systems that contain or use ePHI (164.312(b)). Integrity policies protect ePHI from improper alteration or destruction (164.312(c)(1)).

Person or entity authentication verifies that a person or entity seeking ePHI access is the one claimed (164.312(d)). Transmission security guards against unauthorized access to ePHI sent over an electronic communications network (164.312(e)(1)). The audit trail HIPAA expects for faxes shows how the audit control applies to a fax service.

What do the physical safeguards require for a small practice?

Physical safeguards under 164.310 control the receipt and removal of hardware and electronic media that contain ePHI (45 CFR 164.310(d)(1)). They also limit facility access (164.310(a)(1)) and secure workstations that access ePHI (164.310(c)).

The rule applies all three safeguard types together, so a practice needs a physical control and an administrative control for the same records. The physical standards cover the devices and rooms where ePHI sits. That includes a workstation that sends or receives an online fax, because the workstation security standard covers workstations that access ePHI.

* The regulation text was read at law.cornell.edu and HHS guidance at hhs.gov on October 13, 2026.